Jenkins Azure Service Fabric Plugin Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in Jenkins Azure Service Fabric Plugin versions through 1.6. This vulnerability allows attackers to connect to a Service Fabric URL using credentials IDs specified by the attacker, which could be obtained through other means. Additionally, the plugin does not perform proper permission checks in several HTTP endpoints, enabling credential ID enumeration of Azure credentials stored in Jenkins.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the user, such as connecting to a Service Fabric URL with attacker-specified credentials, potentially allowing for further exploitation or credential capture using other vulnerabilities.